Skip to main content
OpenAI Trail of Bits
Last updated · Oct 23, 2026

The State of
Patch the Planet

Bugs found, patches shipped, and fixes merged at the speed of AI across all the open-source projects in the initiative.

Apply now About the initiative

Issues found

2,036

Potential bugs reported

Awaiting patch

1,357

reported + confirmed

Patches open

213

fix open upstream

Patches accepted

466

merged upstream

Projects

70

codebases under review

Issues over time

Per day Cumulative
May 25 Jun 1 Jul 1 Aug 1 Sep 1 Oct 1 Oct 23

Peak: 224 on Jun 2 · Includes all reports filed, including reports closed during triage

Report pipeline

  1. Issues found 2,036
  2. Awaiting patch 1,357
  3. Patches open 213
  4. Patches accepted 466

Most reported projects

Accepted Open Awaiting patch
  • scapy 231
  • crypto-bigint 205
  • vllm 129
  • keycloak 116
  • samba 89
  • zeek 76
  • ansible 73
  • cryptlib 73
  • php 72
  • nats-server 65

Top 10 of 70 projects

Patch activity

Patch the Planet PTP begins Booked
Mon Wed Fri

Includes all reports filed, including reports closed during triage

Accepted fixes by severity

466 total
high 73 15.7% medium 233 50.0% low 87 18.7% info 31 6.7% undetermined 42 9.0%

CVEs disclosed

80 assigned

Accepted fixes

466 fixes
Project Severity Issue Fix
go-jose medium go-jose accepts ES384/ES512 JWS signatures from weaker ECDSA curves PR
go-jose medium JWE decryption accepts shorter content keys than enc requires PR
go-jose medium go-jose accepts forged EdDSA JWS with malformed embedded OKP JWK PR
boulder medium WFE2 account cache lets a deactivated account create new orders PR
gpac high Oversized CENC IVs cause HLS and HEIF decryption stack overflows PR
gpac high DASH memory-cache heap overflow from oversized Content-Length PR
gpac high Packed fragment sample count overflow PR
scapy medium TLS client sends application data without authenticating the server certificate PR
vllm high PTP-VLLM-018: SHM capability forgery reaches worker pickle PR
vllm medium PTP-VLLM-115: Thinking-budget sparse SWAP duplicates attacker state onto a victim row PR
vllm medium PTP-VLLM-027: Scale-out multimodal placeholder lengths accept non-positive ranges PR
vllm low PTP-VLLM-141: Prefix-cache extra keys are not type-separated PR
aiohttp high Too Many URL-Encoded Fields Block the Event Loop PR
scapy medium SSLv2 endpoints continue after failed record and handshake integrity checks PR
scapy medium A rejected DCE/RPC presentation context remains selected and callable PR
vllm low PTP-VLLM-151: Request-controlled video fps amplifies dynamic sampling work PR
vllm medium PTP-VLLM-088: InternVL `image_size` expands one tiny image into huge tensors, token runs, and render responses PR
vllm medium PTP-VLLM-074: Qwen2.5-Omni `second_per_grid_ts` creates huge empty temporal bucket structures PR
vllm medium PTP-VLLM-073: LlavaOneVision2 `timestamp_decimals` expands tiny videos into huge prompt strings PR
vllm medium PTP-VLLM-072: GLM4.6V and GLMGA trust fake video metadata enough to build huge timestamp lists PR
vllm medium PTP-VLLM-069: Idefics3 and SmolVLM trust request `size.longest_edge` before fixed-tile splitting PR
vllm medium PTP-VLLM-068: Phi4MM `dynamic_hd` lets one request expand a small image into a very large HD crop tensor PR
vllm medium PTP-VLLM-067: Gemma3 request-level pan-and-scan controls cause crop fan-out before inference PR
vllm medium PTP-VLLM-066: MiniCPM request-level `max_slice_nums` causes large visual-slice materialization PR
vllm medium PTP-VLLM-065: DeepSeek-OCR request-level `max_crops` causes large crop-tensor materialization PR
vllm medium PTP-VLLM-063: Moondream3 request-level `crop_size` materializes oversized crop tensors PR
vllm medium PTP-VLLM-054: Isaac request-level `patch_size` creates oversized flattened patch vectors PR
vllm medium PTP-VLLM-053: LFM2-VL request-level `max_tiles` causes combinatorial tile-ratio enumeration PR
vllm medium PTP-VLLM-052: InternVL request-level `max_dynamic_patch` causes crop fan-out before prompt-length validation PR
vllm medium PTP-VLLM-051: Request-level image processor overrides expand tiny images before prompt-length validation PR
vllm medium PTP-VLLM-036: Negative or runtime num_frames overrides disable video frame caps PR
scapy high Packet-derived strings can inject generated DOT and HTML PR
scapy high DCOM object calls reuse a connection for a different exporter PR
scapy high PSP default IV reuses AES-GCM nonces PR
scapy medium Runtime DCE/RPC callbacks leak between server instances PR
scapy medium DCE/RPC client carries authentication state to a new connection PR
scapy medium connect_and_bind ignores a failed authenticated bind PR
scapy high Packet-derived TeX table cells can read local files when compiled PR
scapy medium LDAP silently discards requested signing after an NTLM/SPNEGO bind PR
scapy medium NTLM accepts duplicate channel-binding pairs selected by an attacker PR
scapy medium TLS RSA decryption exposes a Bleichenbacher padding oracle on cryptography 41.0.7 PR
scapy medium An IPv6 request stops WiFi_am from processing later frames PR
scapy medium Required HTTPS channel binding is skipped with a custom SSL context PR
scapy medium TLS server accepts application data after an invalid Finished message PR
scapy medium NTLM accepts a modified challenge and derives a five-byte sealing key PR
scapy medium Closed raw DCE/RPC connections exhaust the listener's file descriptors PR
scapy medium Failed Auth3 authentication leaves DCE/RPC request dispatch reachable PR
scapy high Reserved SMB message IDs let unsigned responses overwrite client files PR
scapy high Mixed-case IPC$ requests expose the SMB server working directory PR
vllm medium PTP-VLLM-043: Rust frontend accepts empty structured-output values and kills EngineCore (v0.25.1) PR
cachecontrol undetermined Two-byte CRLF chunks are omitted from cached response bodies PR
vllm medium PTP-VLLM-029: Guidance treats ngram_gpu -1 padding as a token ID PR
aiohttp undetermined aiohttp server lacks an initial request/header timeout PR
scapy medium TFTP read server retransmits indefinitely without an acknowledgement PR
scapy high snmpwalk repeats forever on endOfMibView PR
scapy high TCP pipe peer EOF makes PipeEngine spin PR
scapy medium Capture-derived virtual ECUs accept an unobserved SecurityAccess key PR
scapy medium UDS selective writes reuse response data from the wrong ECU state PR
scapy high The SMB server replays earlier encrypted requests PR
scapy high TLS RSA clients use a predictable premaster secret PR
scapy high Combined PEM input exposes a TLS server private key PR
scapy low Coalesced HTTP requests bypass ForwardMachine policy callbacks PR
scapy medium HTTP_Client reuses plaintext sockets for HTTPS requests PR
scapy medium LDAPHero turns unprotected SID labels into a directory owner change PR
scapy medium SPNEGO accepts unwrapped NTLM tokens after negotiation starts PR
scapy medium Kerberos reply replay lets an attacker recover passwords sent by kpasswd PR
scapy low ForwardMachine does not authenticate TLS upstreams PR
scapy high DICOM unlimited maximum length stalls C-STORE sending PR
scapy high TACACS+ Single Connection flag disables body obfuscation PR
scapy medium Protected LDAP responses are not bound to the current request PR
scapy high Final SMB guest status silently disables client-required transport protection PR
scapy low Pcapng TLS secret blocks retain one temporary file each PR
scapy low RADIUS answering machine accepts an invalid request Message-Authenticator PR
scapy medium TLS client sends application data after an invalid server CertificateVerify PR
scapy medium Auth3 can lower the protection level negotiated for a DCE/RPC association PR
scapy medium Invalid UTF-8 in a CoAP URI-Path stops later request delivery PR
scapy medium TFTP uploads accept DATA from a different peer PR
scapy medium A valid high DNS qtype stops relaying responders PR
scapy medium LLMNR responder answers queries that did not arrive by link-local multicast PR
scapy medium libpcap copies and reflects bytes beyond a truncated capture PR
scapy medium Kerberos-mode Netlogon accepts an unsigned attacker-selected session key PR
scapy medium DCE/RPC accepts unsigned requests after negotiating packet protection PR
scapy medium RADIUS answering machine accepts unsupported authentication methods PR
scapy medium TLS server accepts client authentication without certificate proof-of-possession PR
scapy high Live TLS endpoints dispatch plaintext after record integrity failure PR
scapy medium SMB required-encryption sessions accept plaintext requests PR
scapy medium SMB server skips request signatures for client-side response exemptions PR
scapy high Recursive SMB write into Scapy cache executes code on import PR
scapy medium Recursive SMB download escapes its local directory PR
scapy high PKINIT client accepts a rogue KDC's AS-REP PR
scapy medium CMS_Engine accepts content under an invalid signature PR
scapy medium Malformed nested SSLv2 ClientHello closes TCPSession capture source PR
scapy medium Framed DNS query closes TCPSession capture source PR
scapy medium Gzip capture bytes stop nonseekable rdpcap input PR
scapy medium Malformed LDAP BER closes TCPSession capture source PR
scapy medium Unknown HelloRetryRequest cipher closes TLSSession PR
scapy medium Short Modbus MEI PDU closes TCPSession PR
scapy medium Truncated pcapng block halts later record processing PR
scapy medium Short TCP-AO option closes IPSession PR
scapy medium Normal RTSP traffic stops every TCPSession capture PR
scapy medium A valid STUN attribute list stops TCPSession captures PR
scapy medium Terminal IPv4 fragments stop IPSession capture sources PR
scapy medium Undersized IEC-104 I-message closes TCPSession capture PR
scapy medium PostgreSQL callback signature closes TCPSession capture PR
scapy medium Fragmented EIGRP datagram closes IPSession capture PR
scapy medium Gzip CRC error aborts compressed capture reading PR
scapy low TLS endpoint XOR causes quadratic global-session lookups PR
scapy low Incremental NRTP bodies cause quadratic stream parsing PR
scapy low CertificateVerify transcript joins grow quadratically PR
scapy low Coalesced Kerberos records reparse quadratically PR
scapy low Growing PCAPNG options parse quadratically PR
scapy medium Valid Microsoft SD Flags control closes stateful capture PR
scapy medium Undersized TLS 1.3 ciphertext closes stateful capture PR
scapy medium Nested GSS-SPNEGO credentials close LDAP stateful capture PR
scapy medium Fragmented DICOM PDU closes stateful capture PR
scapy medium Invalid UTF-8 LDAP control closes stateful capture PR
scapy medium One-byte DNS TCP segment closes TCPSession capture PR
scapy medium MySQL message burst closes TCPSession capture PR
scapy medium IP fragment reassembly exhausts option list PR
scapy medium Short TACACS continuation closes TCPSession capture PR
scapy medium IEC-104 zero-progress object stops stateful TCP capture PR
scapy medium Incomplete MQTT Remaining Length closes stateful TCP capture PR
scapy low Nested typed LDAP filter parsing is superlinear PR
scapy medium Invalid FFDHE share stops TLS server response PR
scapy medium Pre-handshake TLS application data stops endpoint PR
scapy medium Invalid inner IPv4 header closes fragment capture PR
scapy medium MySQL empty frames close stateful capture PR
scapy medium Recursive LDAP filter closes stateful capture PR
scapy low DCE/RPC request before bind stops a connection handler PR
scapy low TCPSession incomplete Kerberos record copy amplification PR
scapy medium IterSocket byte input closes offline sniff PR
scapy medium Fragmented stream response exhausts receive stack PR
scapy medium Truncated LDAP SASL heuristic closes stream capture PR
scapy medium Short OpenFlow OXM value closes stateful capture PR
scapy medium Standard LDAP AbandonRequest closes stateful capture PR
scapy medium IPv6 extension headers close TCP session captures PR
scapy medium Short TLS record header closes stateful capture PR
scapy medium Short IEC-104 I-APDU closes stateful captures PR
scapy medium Short DoIP header closes stateful captures PR
scapy medium Terminal IPv4 fragment closes IPSession captures PR
scapy medium DNS TCP framing mismatch closes stateful captures PR
scapy medium IEC-104 information-object lists close stateful captures PR
scapy medium PostgreSQL stream callback signature closes stateful captures PR
scapy medium Zero BGP message length closes stateful captures PR
scapy low ISO-TP reassembly copies valid fragments quadratically PR
scapy medium Invalid TLS CBC padding closes an active client PR
scapy medium Empty TLS 1.3 ciphertext closes TLSSession PR
scapy medium IPv6 extension header closes TCPSession PR
scapy medium Short TACACS continuation closes TCPSession PR
scapy low Many TLS handshake messages retain quadratic suffix copies PR
scapy low DHCP end padding causes quadratic parsing after logical termination PR
scapy low Attacker-selected DH generator forces superlinear TLS parameter validation PR
scapy medium Misaligned SSLv2 ciphertext closes active client handling PR
scapy medium RFC extensible-match filter closes LDAP TCPSession PR
scapy medium OpenFlow match padding closes TCPSession capture PR
scapy medium Three-byte SSLv2 record closes TCPSession capture PR
scapy medium Malformed XMLRPC closes a selected stream reader PR
scapy medium Empty TGS ticket name stops response handling PR
scapy medium Malformed SSLv2 certificate stops a client response PR
scapy medium Truncated HTTP/2 body closes a StreamSocket PR
scapy medium Non-UTF-8 principal stops automated Kerberos error handling PR
scapy medium Correct ModifyDN newSuperior tag stops LDAP stateful capture PR
scapy medium Empty Kerberos AP-REQ stops a GSS acceptor PR
scapy medium Zero ERF record length hides later capture records PR
scapy medium Unsupported SMB1 dialect list stops server negotiation PR
scapy medium PAP request without User-Name stops the RADIUS answering machine PR
scapy medium Premature TLS 1.3 KeyUpdate closes a TLSSession source PR
scapy medium OpenFlow top-level queue list closes TCPSession PR
scapy medium One hundred one empty MySQL frames close TCPSession PR
scapy medium Pre-authentication SMB transform closes SMBStreamSocket PR
scapy medium Truncated IEC-104 sequence header closes TCPSession capture PR
scapy medium Mixed CLDAP filters terminate the LdapPing answering callback PR
scapy medium Recursive LDAP filter terminates TCPSession capture PR
scapy low Unbounded ECU response catalogue makes capture quadratic PR
scapy medium Short OpenFlow OXM value closes TCPSession capture PR
scapy medium IEC-104 zero-progress object stops TCPSession capture PR
scapy medium Malformed SSLv2 nested handshakes close TCPSession PR
scapy medium Fragmented EIGRP TLVs close IPSession PR
scapy low Option-heavy pcapng has superlinear parsing cost PR
scapy medium IPv4 total-length underflow closes IPSession PR
scapy medium NetFlow ShortOrInt width inference closes collectors PR
scapy medium Invalid pcapng interface ID hides later packets PR
scapy medium One trailing LDP byte closes a stateful sniff capture PR
scapy medium Truncated RTR PDU terminates TCPSession PR
scapy medium NetFlow template field length closes the capture source PR
scapy medium PostgreSQL stream callback closes TCPSession capture processing PR
scapy low Incomplete TCP stream copies grow quadratically PR
scapy medium Correct LDAP ModifyDN tag closes TCPSession PR
scapy medium OpenFlow flow instruction padding closes TCPSession PR
scapy medium Final IPv4 fragment closes IPSession capture PR
scapy medium Valid TCPROS field count closes selected stream capture PR
scapy medium Partial OpenFlow port descriptor closes stateful capture PR
scapy medium Valid Diameter AVP count closes stateful capture PR
scapy medium Direct TCP length mismatch closes stateful capture PR
scapy medium Partial TLS record header closes stateful capture PR
scapy high FIND-483: Partial OpenFlow headers halt TCPSession capture PR
scapy medium FIND-482: BOOTP pool exhaustion stops answering-machine sniffing PR
scapy high FIND-481: Short TACACS authentication payload halts TCPSession PR
scapy high FIND-480: Modbus response function 0x2b truncation halts TCPSession PR
scapy high FIND-470: DICOM partial TCP header halts TCPSession capture PR
scapy high FIND-460: TLS certificate bytes are treated as a local file path PR
scapy high FIND-450: NetFlow zero-length template field hangs session defragmentation PR
scapy high FIND-441: A 101-packet MySQL resultset closes TCPSession capture readers PR
scapy high FIND-420: Modbus function 0x2b truncation halts TCPSession PR
scapy high FIND-350: PostgreSQL traffic closes TCPSession capture readers PR
scapy high FIND-300: DoIP TCPSession reassembly halts sniff on a 1-byte payload PR
scapy high FIND-211: Out-of-order TLS 1.3 KeyUpdate halts TCPSession capture PR
scapy high FIND-180: Short SSH binary packet halts summary-driven sniffing PR
scapy high FIND-172: HSFZ short TCP header halts TCPSession capture PR
scapy high FIND-171: EtherNet/IP short TCP header halts TCPSession capture PR
scapy high FIND-170: SOME/IP short TCP header halts TCPSession capture PR
scapy high FIND-161: One-byte PCOM request halts TCPSession capture PR
scapy high FIND-160: One-byte Skinny payload halts TCPSession capture PR
scapy high FIND-151: Partial DNS-over-TCP message stops TCPSession capture PR
scapy high FIND-150: BGP zero-length frame hangs TCPSession dissection PR
scapy high FIND-140: SSH partial binary header halts TCPSession capture PR
scapy high FIND-130: Empty SMB encryption cipher vector halts client negotiation PR
scapy high FIND-120: RTSP request halts TCPSession capture PR
scapy high FIND-100: Overlapping IPv4 fragments halt IPSession sniff and drop later traffic PR
scapy high FIND-090: Empty TLS 1.3 PSK binder list halts server automaton PR
scapy high FIND-080: Partial MQTT fixed headers halt TCPSession capture PR
scapy high FIND-070: STUN partial header halts TCPSession capture PR
scapy high FIND-061: Partial TLS record headers halt TCPSession capture PR
scapy high FIND-060: Partial Diameter headers halt TCPSession capture PR
scapy high FIND-050: Unsupported UDS_RMBA length halts EcuSession logging PR
scapy high FIND-030: TFTP RRQ blksize zero halts answering-machine sessions PR
scapy high FIND-020: LDP partial message header halts TCPSession capture PR
scapy high FIND-001: DCE/RPC TCPSession reassembly halts sniff on a 1-byte payload PR
scapy medium KrackAP accepts handshake frames from the wrong station PR
scapy medium Unsupported SMB1 dialect stops server handler PR
aiohttp medium Cookie Max-Age Overflow Strands Responses and Exhausts Connector Pools PR
aiohttp medium Cookie Expiration Removes Host-Only Scope from Surviving Cookies PR
aiohttp medium Pure-Python HEAD Request Body Omission Enables CL.0 Request Smuggling PR
vllm low PTP-VLLM-142: Harmony tool continuations drop cache_salt PR
scapy medium lfilter evaluates packets before capture provenance is assigned PR
scapy medium L2TP Offset Size mismatch bypasses inner-packet bridge policy PR
scapy medium IPv6 neighbor cache is not scoped by interface PR
scapy low HTTP_Client returns timed-out responses from later requests PR
scapy low HTTP Client URL parsing can send an allowlisted URL to a different service PR
scapy low One over-limit BGP update corrupts the next one PR
scapy low Automaton.spawn retains and repeatedly destroys stopped connection children PR
scapy medium Extcap capture FIFOs can be readable by other local users PR
scapy high Pcapng TLS secrets persist across independent reader lifecycles PR
scapy low Unknown DNS names grow answering-machine memory without a bound PR
scapy low TFTP read accumulation copies response prefixes quadratically PR
scapy low KRB_AP_REP etype width makes TCP parsing quadratic PR
scapy medium Short CCP DTO closes the sr1 receive socket PR
scapy medium Zero MAX_CTO poisons XCP response matching PR
scapy medium Candump remote request stops capture reading PR
scapy high Rejected ISO-TP frame causes endless zero-delay receive polling PR
vllm medium PTP-VLLM-030: LMCache MP accepts cache_salt='/' until a fatal external validator PR
zeek high DHCP: Memory exhaustion from retained options after analyzer violation —
zeek medium NetBIOS: Memory exhaustion from declared session lengths —
zeek medium UDP: udp_contents events could trigger out-of-bounds reads —
zeek high NVT: Oversized line recovery writes before heap buffer —
zeek high Invalid IPv6 fragments can lead to unbounded state growth —
zeek high Redis: Parsed Redis traffic memory exhaustion —
zeek high Analyzer manager: Equivalent scheduled analyzers could exhaust memory —
zeek high SMB: DCE/RPC memory exhaustion from fragment state —
zeek high DNP3: Memory exhaustion via file control (g70v1) fields —
vllm medium PTP-VLLM-007: Flash late-interaction scoring caches query embeddings under caller-controlled request ids PR
solady undetermined LibSort.groupSum returns mixed-sign int256 keys in unsigned order PR
solady undetermined AddressSet.indexOf can report a stored address as missing PR
solady undetermined LazyShuffler growth can produce duplicate and out-of-range values PR
solady undetermined ZKsync force transfer enables repeatable reentrant extraction of pooled ETH PR
solady undetermined LibBytes.uint8At returns a stale byte after a 32-to-31-byte overwrite PR
solady undetermined LibTransient TStack pop underflows after clear and top accepts an empty stack PR
solady undetermined zkSync beacon-proxy AndCall skips supplied initializer, allowing ownership takeover PR
vllm medium PTP-VLLM-031: Mirrored multimodal IPC caches desync after a rejected request PR
vllm medium PTP-VLLM-084: FireRedLID `num_mel_bins` inflates fbank width before CMVN rejection PR
vllm medium PTP-VLLM-083: FireRedLID `right_context` forces attacker-sized transient audio padding PR
vllm medium PTP-VLLM-114: PyAV/FFmpeg IAMF scalable-layer parsing corrupts the speech-process heap PR
cachecontrol undetermined Permanent redirects bypass freshness requirements PR
cachecontrol undetermined Cache-Control directive names are parsed case-sensitively PR
scapy low NetBIOS name lookups share one cache key PR
scapy low HTTP_Server reuses Basic authentication across requests PR
scapy low TCP sequence gaps amplify stream reassembly work PR
scapy low Extended-length ISO-TP reassembly copies fragments quadratically PR
scapy low SSH mpint decoding is quadratic in BitLenField PR
scapy low IPv6 defragment6 is quadratic on ordered fragments PR
openclaw low Active Memory can recall data for requesters denied memory tools PR
openclaw low Truncated tar.bz2 listings bypass skill extraction limits PR
openclaw low Matrix case folding lets distinct accounts share authorization PR
scapy low FIND-400: LDAP TCP reassembly repeatedly copies incomplete search responses PR
scapy low FIND-401: HPACK Huffman decoding repeatedly shifts an input-sized integer PR
scapy low FIND-250: Repeatable pcapng options make rdpcap quadratic PR
scapy low FIND-101: HICP Configure delimiter parsing is quadratic PR
scapy low FIND-210: EcuSession unique responses cause quadratic capture cost PR
scapy low FIND-410: Coalesced NBT keepalives make TCPSession quadratic PR
openclaw medium Restricted user input can reach an unattended agent with write and command tools PR
vllm medium PTP-VLLM-094: Unbounded Remote Media Download Causes API Server OOM DoS PR
vllm medium PTP-VLLM-041: Rust multimodal frontend starts media fetch work before per-modality item limits PR
vllm medium PTP-VLLM-038: Batch speech file_url bodies materialize before the audio size guard PR
vllm medium PTP-VLLM-037: Chat audio bodies materialize before compressed-size rejection PR
openclaw medium Config redaction exposes offline verifiers for weak Gateway passwords PR
openclaw medium Model tools can use credentials from a disabled Feishu default account PR
openclaw info Prior caller speech is replayed as system instructions in classic voice calls PR
openclaw medium Telegram sends unvalidated host files hidden behind a valid attachment alias PR
openclaw medium Requester-scoped read denies do not block outbound local attachments PR
openclaw low Existing agents can keep reading memory after it is disabled PR
openclaw medium Generic node invocation bypasses per-agent MCP tool denies PR
openclaw info Beam receiver redirects can make OpenClaw POST transcripts to internal services PR
openclaw info Gateway tool deny aliases do not override matching allows PR
openclaw medium Classic inbound voice calls inherit the agent’s full tool authority PR
openclaw medium Limited voice-session credentials can launch an agent with file and command tools PR
openclaw medium Session filename generation can execute tools denied to the requesting user PR
vllm medium PTP-VLLM-080: Duplicate stop token ids are rescanned in the scheduler on every emitted token PR
vllm medium PTP-VLLM-079: Duplicate stop strings are rescanned on every emitted token PR
vllm medium PTP-VLLM-064: DeepSeek V3.2 / V4 chat encoding rescans the full history for every message PR
vllm medium PTP-VLLM-049: `bad_words` is bounded only after expensive frontend tokenization PR
vllm medium PTP-VLLM-039: Streaming chat beam setup allocates per-choice host state before VLLM_MAX_N_SEQUENCES PR
valkey medium RESET leaves CLIENT IMPORT-SOURCE privilege active across pooled connection reuse PR
valkey medium Duplicate GEORADIUS STORE options bypass ACL checks for the final destination key PR
vllm medium PTP-VLLM-137: Generation-config fallback drops explicit code_revision PR
vllm medium PTP-VLLM-136: Incomplete artifact pin propagation in FunAudioChat and Tarsier2 PR
vllm medium PTP-VLLM-135: Raw model config repair drops the trusted revision pin PR
vllm low PTP-VLLM-145: Tensorizer export re-fetches auxiliary artifacts without revision PR
vllm low PTP-VLLM-144: AutoAWQ metadata lookup drops the pinned revision PR
vllm low PTP-VLLM-143: AutoGPTQ metadata lookup drops the pinned revision PR
vllm medium PTP-VLLM-125: Processor helpers drop explicit revision and code_revision pins PR
cryptography low Duplicate self-signed intermediates can cause exponential X.509 path-building CPU use PR
cryptography low GCM delayed-tag decryption accepts sub-4-byte authentication tags PR
sequelize undetermined AP-03-L20: setSessionVariables() can make unsafe MySQL parsing attacker-reachable PR
sequelize undetermined AP-06-L01: Module-global syntax memoization retains attacker-selected paths PR
noble-curves info FROST DKG round-two retry is not bound to the first roster PR
noble-curves info FROST DKG round-two docs call raw private shares encrypted PR
noble-curves info Recovered ECDSA verification ignores the recovery byte and accepts noncanonical signature encodings PR
noble-curves info Jubjub and BabyJubJub expose unsupported Edwards-to-Montgomery conversion helpers PR
noble-curves info Ed448 toMontgomery uses the E448 birational map instead of the Ed448 4-isogeny PR
noble-curves low BLS verify accepts uncompressed signatures that the Signature codec rejects PR
noble-curves low BLS12-381 accepts modularly equivalent non-canonical encodings PR
curl medium --ssl overrides --ftp-ssl-control and permits plaintext FTP login fallback PR
curl low Protocol-relative authority-changing redirects keep CURLOPT_PORT when absolute redirects clear it PR
curl medium Redirected transfers can reuse TLS state established without the configured pinned public key PR
curl low Native CA trust can persist after an easy handle switches to custom CA material PR
curl medium FTP wildcard LIST parsing exposes stale symlink targets to callbacks PR
curl low Bare CR in response headers creates internal-parser and callback desync PR
curl low CURLOPT_DISALLOW_USERNAME_IN_URL is not applied to CURLOPT_CURLU handles PR
curl low Windows case-insensitive environments can make HTTP_PROXY satisfy curl's http_proxy lookup PR
curl medium Windows SSPI SOCKS5 GSSAPI accepts negotiated protection that is not used PR
curl medium Windows SSPI GSSAPI unwrapped data is freed with the SSPI allocator PR
curl low Redirected SigV4 URL credentials can inject HTTP/1.x request headers PR
curl medium Server NTLM state is not origin-bound for non-tunneled proxy reuse PR
curl medium Non-secure host-only cookies can shadow Secure domain cookies PR
curl medium Schannel sends origin client certificates to HTTPS proxies PR
curl low Schannel automatic client certificates survive cross-origin redirects PR
curl low Multiplexed non-tunneled HTTP/2 proxy reuse can store one origin's cookie under another origin PR
curl low Redirected Digest URL userinfo can inject HTTP/1.x request headers PR
curl medium CURL_POLL_REMOVE callback reentry can invalidate socket hash state still in use PR
curl info Reused easy handles keep stale .netrc contents after NETRC_FILE changes PR
curl medium DoH resolver sub-transfers do not inherit parent proxy policy PR
curl info DoH inherits the Schannel automatic client-certificate option from the origin transfer PR
crypto-bigint info [KEMs] Non-P-256 HPKE DHKEM helpers use the P-256 suite ID PR
crypto-bigint low Fixed-width DER decode panics on oversized INTEGER values PR
crypto-bigint info Montgomery bounded exponentiation panics with accidental index error for oversized exponent_bits PR
crypto-bigint info Int serde impl is unreachable because Int does not implement Encoding PR
crypto-bigint info Zeroize can violate NonZero/Odd wrapper invariants PR
nginx high HTTP/3 QPACK encoder stream reset leaves stale insert buffer pointer PR
aiohttp low Host-only cookies become domain cookies after CookieJar persistence PR
aiohttp low DigestAuthMiddleware uses credentials for redirect target challenges PR
aiohttp medium C HTTP parser bypasses max_line_size across fragmented lines PR
aiohttp medium WebSocket max_msg_size Is Enforced Only After Full Frame Buffering PR
aiohttp low TLS SNI/Hostname Verification Bypass Via Client Connection Reuse PR
aiohttp low HTTP/1 pipelined requests queue without a count limit PR
aiohttp medium Unread compressed request bodies bypass client_max_size during cleanup PR
aiohttp low Payload response resources stay open after mid-body disconnect PR
go-jose medium Missing protected JWE header causes panic after successful decryption PR
freenginx medium HTTP/3 DATA prefix can exceed its heap allocation PR
freenginx low mail auth HTTP can leave a stale session ctx after temp-pool destroy PR
freenginx low mail proxy leaves a stale upstream connection pointer after close PR
freenginx low gzip filter leaves `ctx->preallocated` stale after `ngx_pfree()` PR
freenginx medium HTTP Perl async callbacks store unrefcounted `SV`/`CV` pointers PR
freenginx high gRPC request serialization overflows on oversized HPACK :path PR
freenginx medium Script no-cacheable variable re-evaluation can overflow generated buffers PR
simplexmq medium IPv6 server URLs render ambiguous raw host and port pairs PR
simplex-chat medium [Bug]: Downloaded image attachments can be decoded at full dimensions and exhaust client memory PR
simplex-chat medium [Bug]: Android shared content size checks trust provider metadata before unbounded copy PR
ansible undetermined security: C# FailJson exceptions leak no_log values —
urllib3 low urllib3 accepts raw CR/LF in URL hosts and emits them in proxy CONNECT requests PR
ansible undetermined security: password lookup follows symlinks when creating secret files —
ansible undetermined security: async_status jid escapes async directory —
ansible undetermined security: apt_key keyring paths inject extra key imports —
ansible undetermined security: file recurse follows symlinks outside managed directories —
kubernetes-client undetermined JDK HTTP client sends bodyless non-GET requests as GET PR
sqlite undetermined Late vtab module registration leaves shadow tables writable PR
kubernetes-client undetermined Kubeconfig `http://` proxy-url is bypassed for HTTPS clusters PR
kubernetes-client undetermined `https://` proxy URL schemes are treated as plaintext HTTP proxies PR
sqlite undetermined `%!J` UTF-8 precision expansion narrows four-gigabyte input PR
sqlite undetermined Side-effect `sqlite_log()` is treated as innocuous PR
sqlite undetermined `sqlite3_drop_modules()` races module hash iteration PR
sqlite undetermined Serial type 10 smuggles virtual-table no-change value —
sqlite undetermined json_pretty() reads past malformed JSONB object payload PR
sqlite undetermined .archive extraction allows absolute sibling path escape PR
sqlite undetermined Corrupt index cell pointer crosses page boundary PR
sqlite undetermined Malformed UTF-8 precision in `%!s` allows oversized memcpy PR
sqlite undetermined Crafted Rollback Journal Can Delete an Arbitrary File PR
sqlite undetermined Heap buffer overflow in sqlite3ParseUri for over-1GiB file: URI filenames PR
sqlite undetermined Odd UTF-16 prepare length reads past caller buffer PR
kubernetes-client undetermined Fix CI auth safety bug PR
sigstore low Key validity period not checked for verifications involving long-lived keys PR
nss undetermined Heap Buffer Overflow in NSS Legacy libpkix HTTP OCSP Client PR
pythondotorg low [PTP-PYTHON-007] Bug: release-file APIs accept new HTTP python.org URLs PR
pythondotorg medium [PTP-PYTHON-001] Bug: ReleaseFile sidecar URLs can point to different artifacts PR
release-tools low [PTP-PYTHON-008] Bug: add_to_pydotorg can leave partial release-file metadata after post failure PR
borp medium borp UpdateColumns cached plan bypasses column filter PR
borp medium Generated SQL does not escape identifier quote characters PR
pythondotorg medium [PTP-PYTHON-004] Bug: inactive staff API keys still authorize v1 writes PR
pythondotorg medium [PTP-PYTHON-003] Bug: v1 Tastypie writes accept staff sessions without API keys PR
pythondotorg medium [PTP-PYTHON-005] Bug: v1 Tastypie accepts API keys in query strings PR
pythondotorg medium [PTP-PYTHON-006] Bug: v1 Tastypie resources allow broad collection mutations PR
pythondotorg low [PTP-PYTHON-009] Bug: delete_by_release silently honors extra filters PR
release-tools info [PTP-PYTHON-012] Bug: free-threaded Windows artifacts are skipped by add_to_pydotorg PR
pythondotorg low [PTP-PYTHON-014] Bug: custom 404 legacy link can point to an external URL PR
go-jose high go-jose VerifyMulti can return a victim kid for an attacker-signed JWS —
go-jose medium ParseSigned strips whitespace before JSON parsing and can smuggle unprotected JWS headers PR
simplex-chat medium [Bug]: Desktop call localhost WebSocket accepts cross-origin browser control PR
simplex-chat medium [Bug]: WebRTC call switch leaves abandoned preview media active PR
simplex-chat high [Bug]: Relay short-link decompression can exhaust memory PR
simplexmq medium Client-selectable APNS test provider sends APNS bearer traffic to localhost PR
warehouse info README sanitizer allows active input controls PR
warehouse info pip-audit release workflow exposes PyPI OIDC token before publish step PR
warehouse info Warehouse can publish broadened Requires-Dist markers after packaging round trip PR
simplex-chat high [Bug]: Inbound group role changes allow admin owner promotion PR
simplex-chat medium [Bug]: Negative file invitations can bypass auto-receive and file-size gating PR
rust undetermined rustc: unsafe checker skips `ExprKind::Reborrow { source }` and allows unsafe ops under `#![deny(unsafe_code)]` (`#![feature(reborrow)]`) PR
rust undetermined rustc: `become` tail calls between `extern "rust-call"` fns can pass stale/uninitialized indirect tuple args at `-O` PR
rust undetermined rustc: by-value `#[track_caller]` trait method called via `Box<dyn Trait>` uses a vtable shim that drops the caller-location ABI argument (`unsized_fn_params`) PR
simplexmq low XFTP CLI receive path allows sender-controlled filename traversal PR
simplexmq medium SNTRUP761 KEM bindings accept unchecked public key and ciphertext lengths PR
simplexmq medium STM queue store LSET can hijack existing short-link ids PR
simplexmq high XFTP FNEW creates durable metadata before upload or quota reservation PR
simplexmq low Scripted SMP installs enable HTTPS without provisioning web credentials PR
simplexmq low simplex-servers-update writes release metadata before creating parent directory PR
simplexmq high XFTP redirected-description parser error reaches production innerHTML sink and can expose file secrets PR
simplexmq medium XFTP web host gate accepts any referenced current host but fetches first replicas PR
simplexmq low Production XFTP web bundle logs DH secrets and decrypted chunk bytes PR
simplex-chat low [Bug]: Remote controller file upload path allows filename traversal PR
simplex-chat medium [Bug]: Postgres delivery pagination can redeliver group events PR
simplex-chat high [Bug]: Demoted admins keep a live group link that continues accepting joiners PR
simplex-chat high [Bug]: Demoted channel owners can republish stale owner metadata into short-link data PR
simplex-chat high [Bug]: Accepted senders can grow XFTP file descriptions without a total length or part-count limit before file acceptance PR
simplex-chat medium [Bug]: Chat tag and TTL APIs mutate chats by raw ID without user ownership checks PR
simplex-chat low [Bug]: Oversized relay delivery tasks can create durable empty delivery jobs PR
crypto-bigint info UintRef slice copy length checks disappear in release builds PR
crypto-bigint low BoxedUint BitOrAssign drops high limbs from wider RHS PR
crypto-bigint info limb::nlimbs overflows before rounding large bit counts PR
crypto-bigint info Uint div_exact panics on wide divisors with dividend-precision trailing zeros PR
crypto-bigint info Modulus-one edge cases need canonicalization or rejection PR
crypto-bigint info UintRef bytes_precision returns limb count instead of byte count PR
crypto-bigint low MontyParams constant-time equality ignores mod_leading_zeros PR
urllib3 low Absolute request targets include URL fragments PR
aiohttp medium Numeric IPv4 host forms bypass aiohttp resolver policies PR
aiohttp low Environment Proxy Credentials Leak to Different Proxy After Redirect PR
warehouse low packaging DirectUrl credential stripping can leak password fragments PR
simplex-chat undetermined [Bug]: Android service watchdog does not restart after normal teardown PR
warehouse info README sanitizer ignores stricter policy overrides PR
zlib undetermined Truncated gzip header name/comment reuse can over-read deflateSetHeader —
warehouse info Linehaul ingestor retries poison gzip objects indefinitely PR
warehouse info pipx: address zizmor findings in GitHub Actions PR
warehouse info trove-classifiers release workflow exposes PyPI OIDC token before publish step PR
warehouse info pipx release workflow exposes PyPI OIDC token before publish step PR
warehouse info stdlib-list release workflow exposes PyPI OIDC token before publish step PR
warehouse info linehaul release workflow exposes PyPI OIDC token before publish step PR
warehouse info CI installs unpinned lint and test tooling from live PyPI PR
warehouse undetermined pypa/build: backend-path containment can allow sibling directories PR
pythondotorg undetermined [PTP-PYTHON-013] Bug: Fastly purge workflow executes path-derived keys in a secret-bearing shell PR